Umeå Data

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to query a public municipal open-data API as described, with no credential use or persistence, but one helper file/dependency setup appears incomplete.

This skill is reasonable to install if you want public Umeå open-data lookups. Be aware that it uses local shell scripts with curl and jq, and the nearest-location helper appears incomplete because distance.jq is not included.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The nearest-location feature may fail or require an extra helper file not included in the reviewed artifact set.

Why it was flagged

The nearest-location script depends on a local distance.jq filter, but the manifest only includes README.md, SKILL.md, scripts/nearby.sh, and scripts/query.sh. This looks like an incomplete packaging/dependency declaration rather than malicious behavior.

Skill content

jq --arg lat "$LAT" --arg lon "$LON" --argjson limit "$LIMIT" -f "${SCRIPT_DIR}/distance.jq"

Recommendation

Before relying on nearby searches, confirm that distance.jq is included by the publisher and that jq/curl are available in the environment.